A lot of developers are focused on CVEs, as we need to know does the library, language or other building block I use to create a solution have an identified vulnerability that needs mitigating? We probably also pay attention to OWASP (Open Worldwide Application Security Project). But CVEs and OWASP aren’t the beginning and end of the story. This a larger ecosystem of standards involved.
CWE (Common Weakness Enumeration) is of particular interest if you get a chance to step back from fire fighting CVEs. This is interesting because, rather than addressing individually identified vulnerabilities, like the OWASP Top 10s, it looks at a classifies the vulnerabilities. When you get down the Base and Variant categories we’re into specific details. This is helpful, as classifying our CVEs against CWE can tell us the technical domains where the maximum effort can return the greatest level of mitigation/remediation of CVEs (be that creating a patch or defining a mitigation strategy).
I was going to sketch out the relationships between the key standards, but realized an LLM can do a better job, so here is a visual summary:
With so many TLAs in the diagram, here is a quick reference pulled together (including from my own library of handy links).
| Acronym / reference | Expanded form | Official HTTP link | One-sentence summary | Authority / allocation relevance |
|---|---|---|---|---|
| CVE | Common Vulnerabilities and Exposures | cve.org/about/overview | CVE provides globally recognised identifiers and records for publicly disclosed cybersecurity vulnerabilities. (cve.org) | CVE IDs are assigned by authorised CNAs or by MITRE/CVE Program structures. |
| CNA | CVE Numbering Authority | cve.org/partnerinformation/listofpartners | CNAs are authorised organisations that assign CVE IDs and publish CVE Records within an agreed scope. (cve.org) | Primary delegated authorities for allocating CVE IDs. |
| CNA-LR | CNA of Last Resort | cve.org/ProgramOrganization/Structure | A CNA-LR supports CVE assignment when no more specific CNA is available for a vulnerability. (cve.org) | Fallback route for CVE ID allocation. |
| MITRE | The MITRE Corporation | mitre.org/focus-areas/cybersecurity/capabilities-resources | MITRE is closely associated with CVE, CWE, CAPEC and ATT&CK as a maintainer, operator or steward of major cybersecurity knowledge bases. (MITRE) | Current CVE Program Secretariat and maintainer of CWE/CAPEC resources. |
| CWE | Common Weakness Enumeration | cwe.mitre.org | CWE is a community-developed catalogue of software and hardware weakness types that can lead to vulnerabilities. (Common Weakness Enumeration) | CWE IDs are maintained by MITRE; they classify weakness types, not individual vulnerabilities. |
| CWSS | Common Weakness Scoring System | cwe.mitre.org/cwss | CWSS is a CWE-related scoring method for prioritising software weaknesses, but the older version referenced by MITRE is marked obsolete. (Common Weakness Enumeration) | Scores weaknesses, not CVE vulnerabilities; largely secondary compared with CVSS in current vulnerability workflows. |
| CVSS v4.0 | Common Vulnerability Scoring System version 4.0 | first.org/cvss/v4.0 | CVSS v4.0 is the current major CVSS standard family used to express vulnerability severity with base, threat, environmental and supplemental metrics. (FIRST Forum) (Forum of Incident Response and Security Teams) | Maintained by FIRST; it scores vulnerabilities but does not allocate vulnerability IDs. Defines the scoring structure/ranking scale, not ID allocation. |
| NIST | National Institute of Standards and Technology | nist.gov | NIST hosts and maintains important security automation resources including NVD and CPE-related specifications. (NVD) | Maintains NVD and official CPE dictionary infrastructure. |
| NVD | National Vulnerability Database | nvd.nist.gov | NVD enriches CVE records with structured metadata such as affected platforms, weakness classifications, references and severity scores. | Enrichment database, not the allocator of CVE IDs. |
| CPE | Common Platform Enumeration | nvd.nist.gov/Products/CPE | CPE provides standardised names for identifying affected products, platforms and software configurations. (NVD) | Supports product/platform matching in NVD and vulnerability scanners. |
| CAPEC | Common Attack Pattern Enumeration and Classification | capec.mitre.org | CAPEC is a MITRE-maintained catalogue of attack patterns used to understand how weaknesses may be exploited. (CAPEC) | CAPEC entries relate to CWEs and help connect weaknesses to attack behaviour. |
| CSAF | Common Security Advisory Framework | oasis-open.org/committees/csaf | CSAF is an OASIS standard for creating and exchanging structured machine-readable security advisories. (OASIS) | Advisory exchange format that can carry CVE, product status, remediation and scoring data. |
| VEX | Vulnerability Exploitability eXchange | cisa.gov SBOM resources | VEX communicates whether a known vulnerability is exploitable in a specific product or deployment context. (CISA) | Helps qualify CVE findings so consumers can distinguish exploitable from non-exploitable exposure. |
| CISA | Cybersecurity and Infrastructure Security Agency | cisa.gov | CISA publishes operational vulnerability guidance and maintains the Known Exploited Vulnerabilities catalogue. (CISA) | Maintains KEV and participates in the wider CVE/vulnerability ecosystem. |
| KEV | Known Exploited Vulnerabilities catalogue | cisa.gov/known-exploited-vulnerabilities-catalog | KEV is CISA’s authoritative catalogue of vulnerabilities known to have been exploited in the wild. (CISA) | Prioritisation signal based on observed exploitation, not severity alone. |
| EPSS | Exploit Prediction Scoring System | first.org/epss | EPSS estimates the probability that a published CVE will be exploited in the wild within the next 30 days. (FIRST Forum) | Probability-based prioritisation signal that complements CVSS and KEV. |
| CERT/CC | CERT Coordination Center | kb.cert.org/vuls | CERT/CC coordinates vulnerability disclosure and publishes Vulnerability Notes. (CERT Coordination Center) | Can act as a coordinator in disclosure workflows and may interact with CNA/CVE processes. |
| CVD | Coordinated Vulnerability Disclosure | CERT Guide to CVD | CVD is the process of coordinating information among finders, vendors and other stakeholders before public disclosure and mitigation communication. (CERT Coordination Center) | Process framework around disclosure; not itself an ID system. |
| SBOM | Software Bill of Materials | ntia.gov/software-bill-materials | An SBOM describes the software components that make up a product so downstream users can reason about exposure and supply-chain risk. (NTIA) | Often paired with VEX and vulnerability feeds to assess affected components. |
| CycloneDX | CycloneDX Bill of Materials standard | cyclonedx.org | CycloneDX is an OWASP full-stack Bill of Materials standard for supply-chain and cyber-risk use cases. (CycloneDX) | SBOM/VEX-capable format used in vulnerability management pipelines. |
| SPDX | Software Package Data Exchange | spdx.dev | SPDX is an open standard, ISO/IEC 5962:2021, for representing SBOMs and other software supply-chain metadata. (SPDX) | SBOM format often used alongside vulnerability data sources. |
| SWID | Software Identification tag | NIST SWID guidance | SWID tags are ISO/IEC 19770-2 software identification files that can support software asset, patch and vulnerability management. (NIST Computer Security Resource Center) | Product identification standard related to CPE-style inventory matching. |
| SSVC | Stakeholder-Specific Vulnerability Categorization | CMU SEI SSVC v2.0 | SSVC uses decision trees to prioritise vulnerability response actions for specific stakeholder contexts. (SEI) | Prioritisation model that complements CVSS, KEV and EPSS. |
| MITRE ATT&CK | Adversarial Tactics, Techniques and Common Knowledge | attack.mitre.org | MITRE ATT&CK is a knowledge base of adversary tactics, techniques and procedures based on real-world observations. (MITRE ATT&CK) | Related attack-behaviour framework that can be connected to CAPEC/CWE/CVE analysis. |
| OWASP Top 10 | Open Worldwide Application Security Project Top 10 | owasp.org/Top10 | The OWASP Top 10 is a standard awareness document for developers and web application security risks. (OWASP Foundation) | Useful application-security reference that often maps conceptually to CWEs. |
| OSV | Open Source Vulnerabilities / OSV schema | osv.dev | OSV provides a machine-readable vulnerability format and database that maps open-source vulnerabilities precisely to package versions or commit hashes. (OSV) | Adjacent vulnerability-data ecosystem, especially useful for open-source dependency scanning. |
Phil (aka MP3Monster)'s Blog 
You must be logged in to post a comment.